NoMachine 9.5.7 Update: LPE via Parameter Injection in nxchmod.sh Script

Vulnerability Overview NoMachine version 9.5.7 was released, addressing multiple known issues, including: automatic session recordings potentially freezing after user login; network port forwarding possibly malfunctioning on Windows and macOS; users occasionally unable to authenticate to nodes via the web interface; certain cases where Windows users cannot log in to NoMachine Network; black screen issues potentially occurring after macOS restarts; clients unexpectedly closing during file uploads via drag-and-drop; Kerberos credential cache forwarding potentially failing on nodes; validation of CA-signed host certificate chains potentially failing; the NX protocol potentially being unavailable in multi-node environments; server daemons unexpectedly terminating when connecting to physical desktops; potential local privilege escalation risks via parameter injection in the script; and potential inability to forward devices to Windows clients. Scope of Impact Operating Systems: Windows Server 2008/2012/2014/2019/2022, Mac OS X 10.9–10.11, macOS 10.12–26, Linux 32-bit and 64-bit, RHEL 6.0–RHEL 10, CentOS 6.0–CentOS 8.5, CentOS Stream 8–CentOS Stream 10, SLED 11–SLED 15, SLES 11–SLES 15, openSUSE 12.x–openSUSE 16.x, Fedora 10–Fedora 44, Debian 5–Debian 13, Ubuntu 8.04–Ubuntu 26.04, Raspberry Pi 2 ARMv6/ARMv7, Raspberry Pi 3 ARMv6/ARMv7/ARMv8, Raspberry Pi 4 ARMv7/ARMv8, Raspberry Pi 5 ARMv7/ARMv8, ARMv7/ARMv8. Features: Automatic session recording, network port forwarding, user authentication, login, file upload, Kerberos credential caching, certificate chain validation, NX protocol, server daemon, privilege escalation, device forwarding. Remediation Update Version: Upgrade to NoMachine version 9.5.7. Manual Installation or Update: - Windows: Download and save the EXE file, double-click the NoMachine executable, and follow the installation wizard to complete the installation or update. - macOS: Download and save the DMG file, double-click the disk image to open it, double-click the NoMachine application icon, and follow the installation wizard to complete the installation or update. - Linux: Update NoMachine using the graphical package manager or via the command line. - RPM: Download and save the RPM file, install using , or update using . - DEB: Download and save the DEB file, install using , or update using . - TAR.GZ: Download and save the TAR.GZ file, install using , , and , or update using . Automatic Update: NoMachine automatically checks for updates every two days. Updates can be performed through the NoMachine user interface or the server panel. POC Code or Exploit Code No POC code or exploit code is included in this page.

Goal Reached Thanks to every supporter — we hit 100%!

NoMachine 9.5.7 Update: LPE via Parameter Injection in nxchmod.sh Script